CVE-2020-13671

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations. This issue affects: Drupal Drupal Core 9.0 versions prior to 9.0.8, 8.9 versions prior to 8.9.9, 8.8 versions prior to 8.8.11, and 7 versions prior to 7.74.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published
Nov 20, 2020
Last modified
Jun 17, 2026
Added to CISA KEV
Jan 18, 2022
NVD status
Analyzed

Related CVEs from 2020

CVE-2020-136726.1Cross-site Scripting (XSS) vulnerability in Drupal core's sanitization API fails to properly filter cross-site scripting under certain circuCVE-2020-136736.1The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow anCVE-2020-136746.5The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and CVE-2020-136759.8Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, whCVE-2020-136766.5The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. CVE-2020-136777.5Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintendCVE-2020-13687.8An elevation of privilege vulnerability exists in the way that the Credential Enrollment Manager service handles objects in memory, aka 'WinCVE-2020-136886.1Cross-site scripting vulnerability in l Drupal Core allows an attacker could leverage the way that HTML is rendered for affected forms in orCVE-2020-13697.8An elevation of privilege vulnerability exists in the way that the Windows WalletService handles objects in memory, aka 'Windows WalletServiCVE-2020-136927.7PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE.CVE-2020-136939.8An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.CVE-2020-136948.8In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user can execute sudo mysql without a password